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IAB Europe’s input to the European Commission’s report on the application of the General Data 
Protection Regulation - Executive Summary 


This document contains an overview of IAB Europe’s input to the European Commission’s report on the 
application of the General Data Protection Regulation (GDPR). IAB Europe (Transparency Register: 
43167137250-27) is the European-level association for the digital advertising and marketing ecosystem. 


e The GDPR adoption was a substantial milestone, establishing the principles of data protection for 
the foreseeable future, including, and indeed explicitly, in the digital advertising context. 

e Compliance with its provisions require material time and resources from companies that do 
business in and with the European Union (EU). IAB Europe and its members invested considerable 
resources in developing the Transparency & Consent Framework (TCF), which increases 
transparency, choice and accountability in relation to how personal data is processed by different 
actors in the online media and advertising sectors. These legal compliance efforts, amongst others, 
inform our views on the application of the GDPR. 

e We recommend further harmonisation of rules and interpretation of GDPR concepts. In particular, 
we observe: 

o diverging interpretations of the notion of “freely given” consent which should be clarified, 
in a manner that is proportionate and in line with intended outcomes under the GDPR; 

o equal status of the all GDPR legal bases for processing being put in question, and more 
specifically, the availability of legitimate interests as a ground for the lawful processing of 
data for advertising-related purposes; 

o insufficient understanding of the interplay with the ePrivacy instrument, and introduction 
of rules in the proposed ePrivacy Regulation that deviate from the principles adopted with 
the GDPR. 

e We believe that harmonisation of rules and interpretation of GDPR concepts should contribute to 
and enable effective enforcement of the law. Against this background, we advise that: 

o industry legal compliance tools, such as the TCF, can be used as enablers of effective 
enforcement; 

o transnational Codes of Conduct have the potential to bring significant benefits to data 
controllers and legal certainty to data subjects, and we would like to insist on the fact that 
this approach to compliance be prioritised. 

e We fully support the need to protect citizens’ fundamental right to privacy and data protection, but 
we are concerned that in the process one may be losing sight of other fundamental rights protected 
in the EU, such as the right of property and the freedom and pluralism of the media. The GDPR must 
not be interpreted in vacuum, especially since Europe’s content economy depends on digital 
advertising. Advertising accounts for over 81% of European newspaper and magazine digital 
revenues, and any decrease in these monetisation opportunities supporting the objective, good- 
quality journalism would have serious consequences for the social and political landscape in 
Europe. 


For additional information, please contact Greg Mroczkowski, Director, Public Policy at IAB Europe 


(mroczkowski@iabeurope.eu) and Filip Sedefov, Director, Legal at IAB Europe (sedefov@iabeurope.eu). 
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IAB Europe’s input to the European Commission’s report on the 
application of the General Data Protection Regulation 


IAB Europe (Transparency Register: 43167137250-27) represents 25 European national associations 
who in turn represent over 5,000 companies from across the digital advertising and marketing 
ecosystem, from advertisers and advertising agencies on the buy side, news publishers and other ad- 
funded sites and online services on the sell side, and technology providers facilitating the delivery of 
ads. We have over 90 companies in direct membership, including agencies, technology companies, 
publishers and eCommerce companies. 


The adoption of the General Data Protection Regulation’ (GDPR) was a substantial milestone, 
establishing the principles of data protection for the foreseeable future, including, and indeed 
explicitly, in the digital advertising context. Compliance with its provisions require material time and 
resources from companies that do business in and with the European Union (EU). IAB Europe and its 
members invested considerable resources in developing the Transparency & Consent Framework (TCF), 
which increases transparency, choice and accountability in relation to how personal data is processed 
by different actors in the online media and advertising sectors. These legal compliance efforts, amongst 
others, inform our views on the application of the GDPR. We are grateful for the opportunity to provide 
comments on the forthcoming European Commission’s (Commission) report on the application of the 
GDPR. 


This submission has been framed in the following way: 


e Preliminary remarks 
e Part 1 - Introduction - Background 
o Relevance of the GDPR for the digital advertising ecosystem 
o IAB Europe’s Transparency and Consent Framework 
e Part 2 - Harmonisation of rules and interpretation of GDPR concepts 
o Definition of the “consent” legal basis 
o Lawful bases for processing: legitimate interest 
o Interplay with the ePrivacy instrument 
e Part 3 -Effective enforcement of the law 
o Industry legal compliance tools as enablers of effective enforcement 
o  GDPR Transnational Codes of Conduct (CoC) 
e Concluding remarks 


1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons 
with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC 
(General Data Protection Regulation), OJ L 119, 4.5.2016. 
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Preliminary remarks 


According to Art. 97 GDPR, the Commission shall submit a report on the evaluation and review of the 
GDPR to the European Parliament and the Council, due by 25 May 2020. IAB Europe welcomes the 
opportunity to provide feedback on the application of the GDPR, conveying the views of the digital 
advertising and marketing ecosystem, including based on learnings from the legal compliance efforts 
undertaken by the industry. These considerations extend beyond the scope of Art.97(2) GDPR, and as 
such we encourage the Commission not to limit the review to the topics specifically laid out in the 
aforementioned provisions. Our view in this matter reflects the Council’s position on the application of 
the GDPR, as adopted on 21 December 2019’, as well as other EU policymakers’. 


We hope that following the public consultation period, the Commission will reflect some of our input in 
the final text of the report. We would be pleased to have the opportunity to discuss these observations 
with the Commission at an appropriate time. 


On that note, we would also like to observe that the scope for provision of feedback appears to be 
unjustifyingly limited, intimating scarce opportunities for the industry, and the broader society alike, to 
voice their views. IAB Europe’s application to join the GDPR Multi-Stakeholder Group had not been 
retained and the Group itself is very small, which is inadequate given the importance of the data 
protection legal framework. We would recommend the consultation approach be rectified in the future. 


Part 1 - Introduction - Background 


Relevance of the GDPR for the digital advertising ecosystem 


The adoption of the GDPR was a substantial milestone, establishing the principles of data protection 
for the foreseeable future, including, and indeed explicitly, in the digital advertising context. The scope 
of the law is comprehensive and guarantees the protection of personal data both in the context of 
electronic communication services and information society services. In fact, the GDPR unambiguously 
calls out pseudonymous identifiers (Rec. 26), online identifiers, such as cookies, and device identifiers, 
as examples of personal data (Art. 4(1), Rec. 30). In addition, the GDPR contains rules on profiling and 
provides enhanced rights to users where profiling takes place (Art. 4(4), Art. 22, Rec. 72), including where 
user behaviour is tracked online (Rec. 24). The GDPR also explicitly calls out online advertising (Rec. 58). 


? Council position and findings on the application of the General Data Protection Regulation (GDPR) - Adoption, ST 14994 2019 
REV 1, 19 December 2019, p. 4, available at: https://data.consilium.europa.eu/doc/document/ST-14994-2019-REV-1/en/pdf. 

3 European Parliament's Committee on Civil Liberties, Justice and Home Affairs, Contribution of the European Parliament in a 
form of a letter to the Commission, IPOL-COM-LIBE D (2020) 6525, 21 February 2020, p. 2. 
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In practice, the mechanics of the digital advertising ecosystem’ are underpinned by the ability to 
process data for advertising-related purposes, including but not limited to delivery and measurement 
of digital advertising. The data processed for such purposes may include IP addresses, online 
advertising identifiers, URLs of sites that users spend time on, information about user behaviour on 
those sites, and indications about the users’ physical whereabouts (“geolocation” data)°. Most, or all of 
these data points are considered to be personal data under the GDPR. From this perspective, the EU 


privacy and data protection legal framework is the prime legal regime that the ecosystem players 
consider to be relevant’. 


ope 


IAB Europe’s Transparency and Consent Framework 


The GDPR requires that individual users have full transparency about, and control over, any processing 
of their personal data. This obliges data controllers to leverage a relevant legal ground for processing 
personal data and providing users with certain specific pieces of information in order for the processing 
to be legal, in a clear and understandable manner, and with accurate and complete information of all 
relevant issues. 


To facilitate legal compliance, we have created an open-source, cross-industry standard, the IAB 
Europe’s Transparency & Consent Framework’ (TCF). It is to ensure that where personal data is 
processed in connection with the delivery and measurement of advertisements or the personalisation 
of editorial content, consumers as well as industry stakeholders benefit from transparency and control. 


The TCF standardises how websites make the information disclosures required by the GDPR, how the 
sites collect and log users’ choices, how they communicate those choices to their third-party 
technology partners, and what those partners may and may not do as a consequence. It delivers this 
functionality using a combination of software and a digital signal that is transmitted from each website 
to a defined set of technology partners with whom the website works. The signal captures which data 
processing purposes and data controllers the user has authorised, if any, and requires those receiving 
the signal to honour it in accordance with clearly defined rules. 


4 There are many different digital advertising models, including but not limited to: ad servers, ad exchanges, SSPs, DSPs, DMPs, 
ad networks, attribution vendors, market research companies, data companies, affiliate marketing companies and cross 
device vendors. Each digital advertising company has its own unique characteristics. That said, in all instances the ecosystem 
as such relies on the interplay of a variety of market participants, from the buy and sell side, from technology and creativity. 

5° For background, the income for publishers and other content providers is increasingly dependent on behavioural targeting 
instead of non-targeted advertising, with 64% of all digital advertising campaigns drawing on some form of behavioural data. 
What is more, behavioural advertising allows publishers to grow digital revenues, with an income for 1000 ad-impressions 
typically ranging between €1.8 and €25, compared to non-targeted between €0.4 and €8. Source: The Economic Value of 
Behavioural Targeting in Digital Advertising, IHS Markit, 2017, available at https://datadrivenadvertising.eu/wp- 
content/uploads/2017/09/BehaviouralTargeting FINAL.pdf. 

€ Currently, that regime is the conjunction of the GDPR and the ePrivacy Directive (2002/58/EC), with the former regulating the 
processing of personal data and the latter storage and access of information on a user’s device. 

Thttps://iabeurope.eu/tcf. 
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We believe that the TCF is the best and, in fact, the only instrument of its kind, with over 700 technology 
companies subscribing to its rules and hundreds of thousands of websites and apps in Europe and 
beyond having implemented the standard. It currently has between 25-30% market coverage, though 


we expect uptake to increase significantly this year, with the new, second iteration of the TCF? becoming 
fully operable. 


Part 2 - Harmonisation of rules and interpretation of GDPR concepts 


To achieve full market coverage and support legal compliance of the whole sector, standards such as 
the TCF need harmonised interpretations of key GDPR concepts across the EU. There remain significant 
areas where the language of the law is vague and susceptible of being interpreted in different ways. In 
the case of the TCF, this harmonisation will help deliver the level of transparency and control over any 
personal data processing required by the law. 


National Data Protection Authorities (DPAs) have been providing updated guidance to their markets on 
provisions that impact digital advertising’. It is essential that, where the language of the GDPR is not 
clear, DPAs agree on common interpretations that industry can rely on across the EU and which result 
in outcomes intended by the EU legislator. Improved legal certainty through harmonised 
interpretations would enable the GDPR to fully deliver on its promise of creating a unified privacy and 
data protection regime at EU-level that would benefit both consumers and businesses and sit well with 
the broader objective of creating a single European data market space. Such harmonised 
interpretations can and should be driven by the European Data Protection Board (EDPB) to a greater 
extent and following an inclusive consultation process that would yield a truly balanced interpretation. 
Article 70(4) GDPR establishes a procedure for the EDPB’s consulting interested parties and giving them 
the opportunity to comment. The provision lays down a process that can be strengthened in practice, 
ensuring that input from all stakeholders, including the business and industry associations, is 
adequately considered. Learnings from consultation on EDPB draft guidelines as well as from the work 
of the GDPR Multi-Stakeholder Group suggest that not publicising the comments received or limiting 
participation to a small number of stakeholders may not provide for an optimal set-up. Conversely, 
ensuring that EDPB takes into account both technical and commercial realities will inform a future- 
proof character of any guidelines issued. 


Definition of the “consent” legal basis 


Art. 4(11) GDPR provides that “consent of the data subject means any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes”. These cumulative conditions for establishing valid 


8 https://iabeurope.eu/press-releases/iab-europe-iab-tech-lab-release-updated-transparency-consent-framework. 
° For instance, French DPA, CNIL July 2019 Guidelines and Jan. 2020 draft recommendation; Spanish DPA, AEPD Guidance on 
the use of cookies; Irish DPA, DPC Guidance on the use of cookies and other tracking technologies, etc. 
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consent in the context of a data processing purpose are subject to often differing interpretations by 


DPAs. The case in point is the recent observation by the Irish DPA, DPC, advising on divergent views 
amongst DPAs in France, Germany, Ireland, UK and Spain on lawfulness of “implied consent”?°. 


More concerning still are diverging interpretations of the notion of “freely given” consent under the 
GDPR, which for the reasons elaborated on below we are seeking to have clarified in a manner that is 
proportionate and in line with intended outcomes under the GDPR. For instance, the Dutch supervisory 
authority has been issuing a warning to Dutch publishers stating that so-called “cookie walls” - an 
essential tool for monetising and maintaining quality online content - are prohibited under the GDPR”, 
with the Belgian DPA publishing guidance indicating the same”. While these views appear to be an 
anomaly vis-a-vis the law and other DPAs’ positions’, the divergence together with the unclear 
positions of other DPAs that have not yet provided guidance on the topic, generate uncertainties that 
could be easily avoided by applying a comprehensive EU-level approach that enables websites to 
produce quality content and monetise that content, while also complying with the strict transparency, 
choice and accountability GDPR requirements by using tools such TCF. 


What is even more perplexing, the EDPB - composed of representatives of the DPAs and set up precisely 
to ensure consistent application of the GDPR - states in its Opinion on consent that “/.../] consent cannot 
be considered as freely given if a controller argues that a choice exists between its service that includes 
consenting to the use of personal data for additional purposes on the one hand, and an equivalent service 
offered by a different controller on the other hand”™, even though the GDPR merely lays out some 
practices to consider when determining whether consent is freely given without generally prohibiting 
them. 


In particular, and as explicitly stated in Rec. 43 GDPR, the determination of whether consent is freely 
given hinges on an assessment of the necessity of the related processing in the context of the provision 
of a service or the execution of a contract. Further, with regard to the notion of “freely given”, the recent 
opinion of Advocate General (AG) Szpunar in the CJEU Orange Romania C-61/19 case, indicates that 
“freely given” is to be interpreted as combining in some form or another, the criteria of informed and 


10 Report by the Data Protection Commission on the use of cookies and other tracking technologies, 6 April 2020, p.6, available 
at: https://www.dataprotection.ie/sites/default/files/uploads/2020- 
04/Report%20by%20the%20DPC%200n%20the%20use%200f%20cookies%20and%20other%20tracking%20technologies.p 
df. 

11 See https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/normuitleg ap cookiewalls.pdf. 

2 See https://www.autoriteprotectiondonnees.be/cookies. 

13 The Austrian DPA, DSB, for instance, considers it appropriate for publishers to make access to website content conditional 
on either consent, or the payment of a reasonable price for access (DSB-D122.931/0003-DSB/2018, available at: 
https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_ 20181130 DSB D122 931 0003 DSB 2018 00/DSBT 20181130 DSB D12 
2 931 0003 DSB 2018 00.pdf). Guidance by other DPAs such as those in France, Spain or Ireland contains no outright 
prohibitions similar to the one instigated by the Dutch DPA, AP. 

14 EDPB Guidelines on consent under Regulation 2016/679 (Document WP259 rev.01, Revised and Adopted on 10 April 2018), 


p. 8. 
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unambiguous consent, to assess whether a user was, through complete information and active 
behaviour on their part, able to make choices regarding the processing of their personal data”. 


While some forms of digital advertising might not be considered necessary to the provision of an online 
service generally speaking, an outright prohibition of “cookie walls” based on the notion of “freely 
given” such as the one adopted by the Dutch DPA seems to be at odds with the outcomes intended by 
the EU legislator. First, it leaves no space for an assessment of the particular situations and 
monetisation models of service providers seeking to deliver quality online content that depend on the 
greater revenue generated by targeted advertising. Second, it would put advertising funded internet in 
jeopardy, resulting in a steep decrease in the quantity and quality of free advertising-supported services 
and consequently, the erection of paywalls for previously non-paid content. Finally and in line with AG 
Szpunar’s opinion cited further above, such a restrictive interpretation neglects to account for the 
improved transparency, information and choice provided to the user through tools such as the TCF, 
that allow consumers a degree of freedom and control over their personal data that could serve to strike 
an appropriate balance between their rights as a data subject and a publisher’s right to monetise their 
content, neither of which are absolute. 


As it transpires from the above, we do, seek to have DPAs affirm a consistent interpretation of “freely 
given” consent under the GDPR, in line with the logic of the aforementioned Opinion of AG Szpunar, 
that enables for publishers and providers of other online content and services to make access to that 
content and those services conditional on user consent for non-essential data processing to deliver and 
measure advertising. 


Lawful bases for processing: legitimate interest 


The legitimate interest of the controller is a valid ground for the lawful processing of personal data in 
accordance with Art. 6(1)(f) GDPR. As such, it provides ample protection to users, including control and 
transparency about the processing, while giving the law the necessary flexibility in the long term?®. A 
non-negligible degree of uncertainty persists as to the availability of legitimate interests as a ground for 
the lawful processing data related to the delivery of targeted advertising. This uncertainty stems from 
some local interpretations that disqualify this legal basis, some statements included in EDPB Opinions, 
as well as discussions in the context of the ePrivacy Regulation (ePR) proposal. 


We contend that choice of legal bases cannot and should not be ruled out a priori, but depends instead 
onan assessment of the specific situation at hand, possibly supplemented by clear guidance that does 
not disproportionately restrict digital businesses and is applicable across the EU. This is evident upon 


15 See Opinion of A.G. Szpunar in case C-61/19, paras. 44-45. 

16 Article 29 WP in Opinion WP217 on Legitimate interest insists on the fact that the legitimate interest legal basis should not 
be perceived as less constraining than the other legal bases. This legal basis should, thus, not be perceived as offering a lower 
level of protection to the data subject. 


IAB Europe 
Rond-Point Robert 
Schumanplein 11 
1040 Brussels 


(05) 
o 
iab: Belgium 
r iabeurope.eu 
review of the relevant GDPR’s provisions, including the aforementioned Article and accompanying 
Recitals, such as Rec. 39, 40 and 47 GDPR, as well as highlighted in some DPA guidelines”. 


All companies in the broad digital advertising ecosystem - advertisers and advertising agencies on the 
buy side, news publishers and other ad-funded sites and online services on the sell side, and technology 
providers serving both sides - have clear economic and consumer satisfaction interests in the collection 
and processing of non-sensitive personal data. The ability to leverage the legitimate interest legal basis 
cannot be excluded where adequate transparency (Art. 5(1)(a) GDPR), case-specific balancing tests (as 
required by Art. 6(1)(f) GDPR), and the user’s right to object (Art. 21 GDPR) are implemented. For 
instance, the TCF, which allows organisations to leverage the legitimate interest legal basis through its 
standardised signals, purposefully addresses transparency, provides the user with the possibility to 
object and develops guidance on adequate balancing tests, which can crystallise the point where the 
amount and type of personal data tips the balancing scale towards the rights and freedoms of the 
individual. 


Interplay with the ePrivacy instrument 


The potential for the GDPR to bring stability might be severely undermined by legal uncertainty caused 
by legislative initiatives that are ill-timed and introduce divergent rules on the same issues. The ePR 
proposal is a case in point, and starting from the onset of the review of the existing ePrivacy Directive, 
IAB Europe has been calling on lawmakers to understand the interplay between the ePrivacy 
instrument and the GDPR and focus on aligning the two rather than provisions that deviate from the 
principles adopted with the GDPR. 


It is our conviction that lack of alignment in terms of the lawful grounds for processing available in Art. 
6 GDPR and Art. 8.1 of the proposed ePR, coupled with lack of reassurance about permission for 
publishers to make access to online services conditional on the well-informed consent of the user to 
data processing for advertising purposes, will deprive businesses of the flexibility and diversity of data 
processing. It will also eventually put in question the viability of the data-driven digital advertising 
business model, significantly impoverishing the EU media landscape. As the European publishers are 
trying to adapt and build more sustainable digital business models accessible to all types of audiences, 
it cannot be reasonably expected that they would switch to a subscription-only revenue model. 
Moreover, an inevitable consequence of the latter would be emergence of a two-tier society in which 
only those citizens who are able to pay for news and information will benefit from a rich range of 
sources, obviously an undesirable development in any democratic society. 


17 For instance, DPC Guidance Note: Legal Basis for Processing Personal Data, December 2019, p. 2, available at: 
https://www.dataprotection.ie/sites/default/files/uploads/2019-12/Guidance%200n%20Legal%20Bases_Dec19_1.pdf. 
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We are deeply concerned about the fact that while on paper digital advertising is a lawful business 


model supporting the media ecosystem, and arguably the GDPR provides for a harmonised approach, 
the real-life experience shows that the opposite is happening. 


ope 


The issue of the so-called conditionality of access to content, discussed in the context of the proposed 
ePR, is intimately linked with defining certain GDPR’s concepts, such as consent, and the notion of 
“freely given” in particular. Coherence in this regard can be maintained by strong, unambiguous legal 
presumptions, as laid out currently in Rec. 25 of the ePrivacy Directive, and further clarification of the 
concept of GDPR’s consent. 


As explained above in the section on the definition of the “consent” legal basis, Art. 7(4) GDPR is being 
interpreted by the DPAs as if there were an outright prohibition of online services making access to their 
advertising-funded content conditional on consent to storing and/or accessing information on users’ 
devices for advertising purposes. 


Repeated calls’* by the industry for further reflection on the proposed ePrivacy Regulation amidst the 
learnings from the GDPR implementation saw support from some Member States”, and other EU 
policymakers. The European Parliament's European Parliament's Committee on Civil Liberties, Justice 
and Home Affairs called upon the “Commission to evaluate the interactions and potential overlaps, of the 
GDPR with Directive 2002/58/EC ('e-Privacy Directive')””°. 


Part 3 - Effective enforcement of the law 


Harmonisation of rules and interpretation of GDPR concepts, as laid down in Part 2 of this paper, should 
contribute to and enable effective enforcement of the law. 


Industry legal compliance tools as enablers of effective enforcement 


Effective enforcement is necessary to ensure that non-compliance by a minority of rogue actors is 
adequately sanctioned and cannot damage the strict compliance commitments undertaken by the rest 


18 The calls derive, too, from evidence-based research. For instance, WIK Report on the Economic Impact of the ePrivacy 
Regulation on Online Advertising and Ad-based Digital Business Models issued in November 2017 (available at: 
https://www.wik.org/fileadmin/Studien/2017/WIK_ePrivacy_study ENGLISH.PDF) found that “the European Commission’s 
impact assessment is inadequate” (p. 6). Similarly, the Impact Assessment Institute Study on the European Commission Impact 
Assessment on ePrivacy produced in July 2017 (available at: https://www.impactassessmentinstitute.org/eprivacy) revealed 
that “compilation of new robust evidence is necessary to inform consideration and development of measures that will meet the 
objectives in an effective manner” (p. 2). 

19 The Council has been consistently calling for a reality check of the proposed ePrivacy Regulation vis-a-vis the GDPR, in the 
course of several Presidencies. For instance, please be referred to Outcome of the 3658th Council meeting in the Transport, 
Telecommunications and Energy constellation, 3-4 December, p. 15, available at: 
https://www.consilium.europa.eu/media/37382/st14971-en18.pdf). 

2 European Parliament's Committee on Civil Liberties, Justice and Home Affairs, Contribution of the European Parliament in 
a form of a letter to the Commission, IPOL-COM-LIBE D (2020) 6525, 21 February 2020, p. 6. 
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of the industry and undermine user trust and confidence. Recognising the TCF as a valuable legal 
compliance tool can contribute to effective enforcement. This is thanks to the standardised 
transparency and accountability it enables and the audit trail it creates, by capacitating data controllers 
to keep a digital record of what user permissions were granted and whether those permissions were 
respected. The digital record can be audited by the regulators, by consumers, by publishers, or by 
commercial partners implementing the standard. The ability of tools such as the TCF to bring the 
industry to a high standard of legal compliance can and should go hand in hand with appropriate 
enforcement actions that account for organisations’ clear compliance efforts demonstrated by their 
voluntary participation in such cross-industry standards. 


GDPR Transnational Codes of Conduct (CoC) 


Transnational Codes of Conduct have the potential to bring significant benefits to data controllers and 
legal certainty to data subjects, since they clarify how the GDPR can be applied with regard to the 
particular features of a given industry or sector. Art. 40 GDPR encourages Member States, DPAs, the 
EDPB and the Commission to promote the drawing up of codes of conduct, contributing to sector- 
specific compliance with the regulation. We strongly support an approach whereby the institutional 
stakeholders listed in Art. 40(1) GDPR undertake meaningful initiatives that seek to promote the 
establishment of codes of conduct and are pleased to see the EDPB’s efforts in providing guidance in 
this respect”. 


We would like to insist on the fact that this approach to compliance be prioritised, particularly where a 
code of conduct has the potential to apply transnationally, mirroring the harmonisation operated by 
the GDPR. DPAs in particular should have the resources to adequately assess and position themselves 
as supporters of Codes within a reasonable timeframe, where these clearly contribute to sector-wide 
pan-European GDPR compliance. 


A tool such as IAB Europe’s TCF is a prime example of a situation where recognition as a transnational 
GDPR Code of conduct would bring significant compliance benefits to both consumers and the industry. 
The resulting increased market coverage would greatly improve overall compliance levels in the digital 
advertising industry, contribute to a streamlined user experience, as well as provide an adequate EU- 
wide tool enabling national authorities to assess compliance across this inherently transnational 
sector. 


21 EBPB Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679, version 2.0, 4 June 2019, 
available at: https://edpb.europa.eu/sites/edpb/files/files/filel/edpb_guidelines_ 201901 _v2.0_codesofconduct_en.pdf. 
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Concluding remarks 


To conclude, we would like to share some general observations that are relevant from the legal 
compliance perspective, in recognition of the industry’s underlying objective of ensuring that 
advertising can continue to support a pluralistic media and the continued availability of a universe of 
online information and other services on terms that make them accessible to everyone. While we fully 
support the need to protect citizens’ fundamental right to privacy and data protection, we are 
concerned that in the process one may be losing sight of other fundamental rights protected in the EU, 
such as the right of property and the freedom and pluralism of the media. 


Acknowledging that, as stipulated in Rec. 1 GDPR, “the protection of natural persons in relation to the 
processing of personal data is a fundamental right”, one should also recognise that it is the possibility of 
using data to deliver advertising and measurement, linked to which is the user’s willingness to receive 
advertising based on the data, that is at the heart of digital advertising business model, and not solely 
the data itself. The GDPR is precisely about creating a safe space for users to elect to make informed 
decisions about having their data processed, with guaranteed control over the data and fair processing 
- in this paradigm the law enables access to digital ad-supported content and services with full respect 
of users’ privacy. 


Arbitrary and quixotic interpretations of the law undercut the possibility for users to make choices - 
something that will penalise citizens seeking information and other online content and services on 
terms that align to their economic possibilities. 


As evidenced in a report by Guillaume Klossa, special adviser to European Commission Vice-President 
Andrus Ansip, the media sector is principally reliant on advertising as one of the three major revenue 
sources, alongside consumer payments (transaction and subscription) and public funding, and press 
sustainability would be seriously impaired without advertising revenue”. What we are observing in the 
market is that online content and services can be advertising-funded or subscription-only, or media 
owners can use a mixed model where the service is not free but the cost to users is lower because 
revenue from subscriptions is supplemented by revenue from advertising. Overall, digital advertising 
accounts for over 81% of European newspaper and magazine digital revenues”, which clearly 
demonstrates dependency of Europe’s content economy depends on this income stream. Depriving the 


22 Towards European Media Sovereignty. An Industrial Media Strategy to leverage Data, Algorithms and Artificial Intelligence, 
28 March 2019, p. 37, available at: https://ec.europa.eu/commission/sites/beta-political/files/gk_special_report- 
european media sovereignty.pdf. Similarly, the Cairncross review of the media landscape, commissioned by the UK 
Government and published in February 2019, discusses at length diversification of publishers’ revenue streams in the light of 
the need to ensure the sustainability of quality journalism. It concludes that press sustainability would be seriously impaired 
without advertising revenue (pp. 39-47, available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/779882/021919 DCMS 
Cairncross Review_.pdf). 

233 The Economic Contribution of Digital Advertising in Europe, IHS Markit, 2017, p. 4, available at 
https://datadrivenadvertising.eu/wp-content/uploads/2017/09/DigitalAdvertisingEconomicContribution FINAL-1.pdf. 
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free and independent news media across Europe of advertising revenue opportunities would eventually 
put at risk the pillars of our society: the freedom of expression, media diversity, and democratic debate. 


Behavioural targeting data generates significant revenue uplifts in comparison with run-of-network 
advertising, which buys clicks or impressions without reference to behavioural data. This, in turn, 
allows media companies to build more sustainable digital business models, while serving the interests 
of users who are provided with higher quality advertising that is likely to be relevant for them and 
reduces the chance of their being exposed to ads too frequently. It is sometimes argued that contextual 
advertising that entails the processing of little or no personal data would achieve the objective of 
funding news and other online content, but with fewer risks to consumers. This argument does not 
stand up to scrutiny. Whilst highly specialised “niche” sites may be able to offer advertisers narrow 
segments of users with clearly identifiable interests, generalist sites such as news media cannot. The 
investigative reporting that is essential to holding power to account in a democratic society cannot be 
funded with contextual ads alone. Moreover, without the collection of use of personal data for ad 
performance measurement - a critical point that is often ignored in the debate - contextually targeted 
ads are of little value to advertisers. 


The ability to process personal data for advertising-related purposes, including improving 
addressability of advertising, enables smaller publishers to compete with the vertically-integrated 
online platforms in a way they could not hope to otherwise. This is because of scale. The sheer volume 
of data that users willingly provide to the platforms enables them to offer advertisers larger audiences 
who will likely be receptive to advertising about particular products and services. Small publishers 
cannot hope to achieve such scale on their own, yet cross-site profiling in full view and under the control 
of individual users can give those small publishers asymmetrical leverage, enabling them to compete 
with the platforms. It is our conviction that the so-called open web, supported by advertising, can help 
the European media in a highly competitive digital landscape, fully in line with the Commission’s 
priority, set out in the 2020 European strategy for data, to ensure “incentives for data-driven businesses 
to emerge, grow and innovate in the EU today”™*. 


*4 A European strategy for data, COM(2020) 66 final, p. 3. 
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